secure user api for admin only